Error when getting updates on older windows instance

[arossert]

I'm trying to get the Windows updates on Windows Server 2012 and getting this error:

In [17]: from windows_tools import updates
In [18]: updates.get_windows_updates_com()
---------------------------------------------------------------------------
com_error                                 Traceback (most recent call last)
Cell In[18], line 1
----> 1 updates.get_windows_updates_com()

File windows_tools\updates\__init__.py:106, in get_windows_updates_com(update_pa
th, filter_duplicates, include_all_states)

File <COMObject CreateUpdateSearcher>:2, in QueryHistory(self, startIndex, Count)

com_error: (-2147352567, 'Exception occurred.', (0, None, None, None, 0, -2145124345), None)

I think that you need to handle errors in get_windows_updates_com so we will at least get the updates from WMI and registry, I will be happy to do a PR if it is acceptable solution by you

[deajan]

Yet this code has been tested on multiple Windows Server 2012 setups (actually, it was tested from Server 2008 up to 2019).

I suppose you did run this code as admin ?
The error you're getting is 0x80020009 with detailled error code 0x80240007. A quick google look tells me your windows update base is corrupted.
Guess that's on your machine.

As for the suggestion, I'm all in for a PR.
But before working on it, what exactly do you want to do ?
I'm all in for error handling, but that should happen at a higher level than this function, since silently bypassing errors isn't an acceptable solution.

If you have a viable solution, I'd be happy to apply it.

[arossert]

Hi @deajan Thanks for the quick response, this is a nice observation, do you know what I can do to check why my update base is corrupted? I'm running this code on an EC2 instance.

My current issue is that when I'm calling the main get_windows_updates function I get an exception even when the WMI and REG methods can still work and provide some data, so maybe wrap the get_windows_updates_com call with try block inside this function to handle cases when COM is failing (it is not a bad idea to also do it on the other calls just in case), this can also produce a warning log to not hide the fact that there was an error

[arossert]

@deajan Something weird is going on, when I run this PowerShell command it works 🤔

(New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher().Search("IsInstalled=0 and Type='Software'").Updates

I did a bit more digging and I could not find why it is not working but I did find that searcher.Search("Type='Software'").Updates do work and I do get the list, I'm not sure what the difference is but maybe you can consider using this implementation instead? (the output is a bit different so minor changes to the flow are needed)

[deajan]

do you know what I can do to check why my update base is corrupted?
Begin googling the hexa version of the error messages. Generally speaking, you should begin running chkdsk /F, sfc /scannow and dism /Image:C:\ /Cleanup-Image /RestoreHealth /Online

After these, there's the windows update repair tool from MS.

so maybe wrap the get_windows_updates_com call with try block inside this function to handle cases when COM is failing (it is not a bad idea to also do it on the other calls just in case), this can also produce a warning log to not hide the fact that there was an error

That's up to you to code this, since my function is expected to fail on damaged systems. I prefer knowing that updates system is broken than getting half empty responses

maybe you can consider using this implementation instead?

No, I won't change an implementation of a software that has been tested on hundreds of servers, just to satisfy one which isn't working.
Of course, you could implement it, add the results and then deduplicate them like I do.
Open for a good PR.

[arossert]

@deajan Thanks for the detailed answer, I executed all the commands and also rebooted the instance but still the searcher.QueryHistory(0, result) call fails on the same error.

It could be something that only happens in my instance (hopefully).

I'm willing to create a PR changing the implementation but if you prefer not to do so I might implement it internally and not use windows_tools in this case.

[deajan]

Simple yet elegant solution here, implement allow_errors: bool in get_windows_updates function.
This way, it can be called twice, first with an error to acknowledge that the system has issues, which you get with a try/catch, secondly with allow_errors=True so you still get minimum information.

[arossert]

Will you willing to do so?

[deajan]

Didn't you say you'd be willing to make a PR ? ^^

[arossert]

I did, I can work on this next week, Tx 😃

[deajan]

Okay, I'll happily merge.